Easy To Use Patents Search & Patent Lawyer Directory

At Patents you can conduct a Patent Search, File a Patent Application, find a Patent Attorney, or search available technology through our Patent Exchange. Patents are available using simple keyword or date criteria. If you are looking to hire a patent attorney, you've come to the right place. Protect your idea and hire a patent lawyer.

A method and apparatus for monitoring the behaviour of an individual
communication client (200) in relation to the behaviour of a group of
communication clients. A client database (202a) collects client data
based on activities reflecting the individual client's behaviour, where
the collected client data forms a resulting client behaviour profile
(GP). A comparing unit (202b) compares the collected client data with a
behaviour profile (GP) of the client group reflecting the behaviour of
the client group. An alert generator (202c) then issues an alerting
signal (A) if an unacceptable behavioural deviation between the
individual client and the client group is detected.

1. A method in a behaviour monitoring server of monitoring the behaviour
of an individual communication client in relation to the behaviour of a
group of communication clients, wherein the individual client operates a
communication terminal in a communication network and has joined or
intends to join said client group for sharing client data, comprising the
following steps executed by the behaviour monitoring server:collecting
client data based on activities reflecting the individual client's
behaviour in the communication network, said collected client data
forming a resulting client behaviour profile that reflects the behaviour
of the client,comparing the collected client data with a behaviour
profile of said client group reflecting the behaviour of the client group
in the communication network and including behavioural parameters of
interest to the group, wherein the group behaviour profile has been
created based on activities of the members of the group, andissuing an
alerting signal if an unacceptable behavioural deviation between the
individual client and the client group is detected by finding that a
measured behavioural parameter in the client behaviour profile or in the
group behaviour profile falls outside a defined accepted parameter range.

2. The method according to claim 1, wherein the group behaviour profile
defines an expected or required norm of behaviour for the client group,
and the alerting signal is issued if an unacceptable behaviour of the
individual client in view of the client group is detected.

3. The method according to claim 1, wherein the group behaviour profile is
compared with said resulting client behaviour profile, and the alerting
signal is issued if an unacceptable behaviour of the client group in view
of the individual client is detected.

4. The method according to claim 2, wherein the alerting signal is
provided as a notification to said individual client or to an associated
administrator.

5. The method according to claim 2, wherein the alerting signal is
provided as a notification to at least one client in the client group or
to an associated administrator.

6. The method according to claim 1, wherein the group behaviour profile is
adjusted based on one or more detected deviations between the individual
client and the client group.

7. The method according to any claim 1, wherein the client data is
collected by using any mechanisms for providing call data records,
presence data and context data.

8. The method according to any claim 1, wherein the collected client data
relates to any of:browsing and downloading activities, financial
transactions, geographical movements, the duration of calls and sessions,
bandwidth consumption, and the time of day, week or season for different
client activities.

9. The method according to claim 1, wherein the group behaviour profile is
created based on a history of client data collected for activities
reflecting the client group's behaviour.

10. The method according to claim 9, wherein the group behaviour profile
is updated continuously based on client data collected based on further
activities by clients in the client group.

11. The method according to claim 1, wherein the method is used for
detecting fraudulent or otherwise improper behaviour.

12. The method according to claim 1, wherein said collected client data
forms a plurality of resulting client behaviour profiles corresponding to
a plurality of client groups that the individual client has joined or
intends to join for sharing client data.

13. An apparatus in a behaviour monitoring server for monitoring the
behaviour of an individual communication client in relation to the
behaviour of a group of communication clients, wherein the individual
client operates a communication terminal in a communication network and
has joined or intends to join said client group for sharing client data,
comprising:a client database for collecting client data based on
activities reflecting the individual client's behaviour in the
communication network, said collected client data forming a resulting
client behaviour profile that reflects the behaviour of the client,a
comparing unit for comparing the collected client data with a behaviour
profile of said client group reflecting the behaviour of the client group
in the communication network and including behavioural parameters of
interest to the group, wherein the group behaviour profile has been
created based on activities of the members of the group, andan alert
generator for issuing an alerting signal if an unacceptable behavioural
deviation between the individual client and the client group is detected
by finding that a measured behavioural parameter in the client behaviour
profile or in the group behaviour profile falls outside a defined
accepted parameter range.

14. The apparatus according to claim 13, wherein the group behaviour
profile defines an expected or required norm of behaviour for the client
group, and the alert generator issues the alerting signal if an
unacceptable behaviour of the individual client in view of the client
group is detected.

15. The apparatus according to claim 13, wherein the comparing unit
compares the group behaviour profile with said resulting client behaviour
profile, and the alert generator issues the alerting signal if an
unacceptable behaviour of the client group in view of the individual
client is detected.

16. The apparatus according to claim 14, wherein the alert generator
provides the alerting signal as a notification to said individual client
or to an associated administrator.

17. The apparatus according to claim 14, wherein the alert generator
provides the alerting signal as a notification to at least one client in
the client group or to an associated administrator.

18. The apparatus according to claim 13, wherein the apparatus adjusts the
group behaviour profile based on one or more detected deviations between
the individual client and the client group.

19. The apparatus according to claim 13, wherein the client database
collects the client data by using any mechanisms for providing call data
records, presence data and context data.

20. The apparatus according to claim 13, wherein the collected client data
relates to any of:browsing and downloading activities, financial
transactions, geographical movements, the duration of calls and sessions,
bandwidth consumption, and the time of day, week or season for different
client activities.

21. The apparatus according to claim 13, wherein the apparatus creates the
group behaviour profile based on a history of client data collected for
activities reflecting the client group's behaviour.

22. The apparatus according to claim 21, wherein the apparatus updates the
group behaviour profile continuously based on client data collected based
on further activities by clients in the client group.

23. The apparatus according to claim 13, wherein the apparatus is used for
detecting fraudulent or otherwise improper behaviour.

24. The apparatus according to claim 13, wherein said collected client
data forms a plurality of resulting client behaviour profiles
corresponding to a plurality of client groups that the individual client
has joined or intends to join for sharing client data.

Description

TECHNICAL FIELD

[0001]The present invention relates generally to a method and apparatus
for monitoring or observing the behaviour of a client in a communication
network. In particular, the invention is concerned with the client's
behaviour in relation to a group of clients.

BACKGROUND

[0002]With the emergence of 3G mobile telephony, new packet-based
communication technologies using IP (Internet Protocol) have been
developed to support wireless communication of multimedia. For example,
communication protocols in GPRS (General Packet Radio Service) and WCDMA
(Wideband Code Division Multiple Access) support packet-switched
multimedia services, as well as traditional circuit-switched voice calls.

[0003]A network architecture called "IP Multimedia Subsystem" (IMS) has
been developed by the 3.sup.rd Generation Partnership Project (3GPP) as a
platform for handling multimedia services and sessions in the packet
domain, based on IP transport. Thus, an IMS network can be used to
initiate and control multimedia sessions for any IP enabled terminals
being connected to any type of access networks. The sessions are
controlled by various suitable session managing nodes, including the
well-known IMS nodes S-CSCF (Serving Call Session Control Function),
I-CSCF (Interrogating Call Session Control Function) and P-CSCF (Proxy
Call Session Control Function).

[0004]Invoked multimedia services are enabled and executed by various
application servers, either servers within the IMS network or external
"third party" servers. Further, a main database element HSS (Home
Subscriber Server) in the IMS network stores subscriber and
authentication data for subscribing clients. IMS is mentioned in this
description for illustrative purposes only, although the present
invention is not limited to using an IMS network.

[0005]A signalling protocol called "SIP" (Session Initiation Protocol,
according to the standard IETF RFC 3261) is typically used for handling
multimedia sessions in IMS networks and other service networks.
"SIP-enabled" terminal and servers can thus use this standard to initiate
and terminate communications of multimedia by means of the IMS network.

[0006]A particular example of services that can be employed by means of an
IMS network or other service networks is the so-called "presence"
services. Presence is basically a dynamic and variable state profile of a
client, and the presence services basically involve the publishing of
presence data of the client to make it available to other clients and
applications. Presence data may indicate the behaviour of a client in
some respect by basically defining the state or situation of a client and
his/her equipment. The presence data may include the following "client
states": [0007]A client status, e.g. available, busy, in a meeting, on
holiday, etc. [0008]A terminal status, e.g. switched on/off, engaged, out
of coverage, etc. [0009]The geographic location of the client/terminal.
[0010]Terminal capabilities and selections, e.g. functionality for SMS,
MMS, chatting, games, video, etc. [0011]Other personal client
information, e.g. interests, occupations, personal characteristics,
moods, etc.

[0012]This information, or any selected parts thereof, can be stored in an
application server in the IMS network, often referred to as the presence
server, based on publications of "events" related to the client. These
event publications may be received from either the client's communication
terminal or his/her used network, whenever any presence data of the
client is changed or updated.

[0013]A client may also subscribe for selected presence data of one or
more other clients, e.g. according to a predefined list of an established
client group sharing such presence data. Such presence subscriptions are
typically also handled by a presence server. The subscribing client can
then receive notifications from the presence server regarding current
presence data, either automatically or upon request.

[0014]In SIP, a message called "SIP PUBLISH" can be used by clients to
provide dynamic data to the presence server. Further, the SIP message
called "SIP SUBSCRIBE" can be used by clients to subscribe for dynamic
data of other clients, as handled by the presence server. Another SIP
message called "SIP NOTIFY" can be used by presence servers when
providing updated presence data to subscribing clients.

[0015]Recently, a concept has also been developed to provide refined or
adapted information on communication clients, e.g. to increase the
usability of applications for invoked services depending on the client's
current situation or behaviour. This concept is generally referred to as
the distribution of "context" information, which may be implemented by
using similar mechanisms as for the above-described presence services. It
is desirable to develop "context-aware" applications to achieve services
optimally adapted to the prevailing circumstances. The context
information reflecting the client's situation can thus be used to create
an optimal service, or be shared in client groups in the same manner as
presence data.

[0016]A context server may be used to collect information on the client by
receiving client data from various sources, such as "sensors" or the like
adapted to measure or register various variables or the like
characterising the current state, status or situation of the client. For
example, sensors may be arranged to measure physical characteristics such
as temperature and movements, or to register terminal activities or any
of the client states mentioned above for presence services. Hence, the
above-described context information and the presence data of a client
actually reflect the behaviour of that client in some respect, e.g. in
terms of terminal usage and geographic whereabouts.

[0017]The currently available mechanisms for providing presence data and
context data for a client of interest to a requesting party are
illustrated schematically in FIG. 1. The client of interest 100 is a user
of a mobile terminal T that frequently sends dynamic data, or event
publications, to a presence server 102 basically as described above, e.g.
in SIP PUBLISH messages using an IMS network (not shown). The presence
server 102 may in turn send notifications to the requesting party 104,
e.g. a subscribing client, regarding current presence data, e.g. in SIP
NOTIFY messages.

[0018]In addition or alternatively, one or more sensors 106 may be
arranged as described above to provide raw context data to a context
server 108, the data being received and stored in a context storage unit
108a. The shown sensors 106 may also represent functions reflecting
client activities in the terminal T or in the used network, not shown.
Moreover, the existing routines in the communication network for
generating call data records for clients can also be used to provide
context data.

[0019]The stored raw data may then be processed and refined in a context
refiner 108b by applying predefined rules 108c on the raw data, in order
to derive or calculate new refined context information from the raw data.
The predefined rules 108c may include algorithms or the like that
calculate certain parameters, draw conclusions or create compilations
from the raw data.

[0020]The refined context can then be distributed to the requesting party
104 according to conventional routines, not described here further. A
policy for controlling the context distribution may also have been
defined basically by the "context owner", who may be a network operator
or the client 100 himself/herself. The policy may dictate the extent of
availability of the context data to requesters, or that a particular
requester is allowed to receive only some part of the available context
data, etc. It should be noted that the requesting party 104 may obtain a
subscription to receive context information from the context server 108
on a more or less continuous basis, i.e. in a similar manner as for the
presence data.

[0021]Typically, the context information pertains to an individual client
who has a certain profile as defined by his/her current context. However,
a client may also belong to an established group of clients, having an
aggregate profile shared by its members. For example, members of a family
group may have individual contexts while the family may have a common
context with an aggregate profile shared by its members, whereas another
group specifically interested in, e.g., football games may have a
completely different profile.

[0022]WO 06/115442 discloses a mechanism where the particular needs of a
requesting group of clients can be met by providing relevant context
information regarding a specific object of interest, which information
has been adapted to particular requirements and needs of the group. In
this solution, a "customized" rule can be created for the requesting
group defining conditions for refined context information. An aggregated
context function creates an aggregated context for the group by
collecting individual context data for each of the group's members, in
order to create the customized rule valid for the group. The customized
rule is sent in an adapted request to a context server for refined
context information on the object of interest. Context data refined
according to the customized rule is then received in response from the
context server.

[0023]It is thus common to form groups with plural members having mutual
interests in some respect, in order to share information between the
members by using any of the above-described mechanisms for presence
services and client contexts.

[0024]However, when a communication client wants to join an existing group
of communication clients as a new member, it is sometimes not possible to
determine whether he/she will fit in with the group in some respect or
not, or whether the group can accept the new member and vice versa. The
new member may also want to find out whether the group is legitimate and
can be trusted before joining, and the group may likewise want to know
that the new member is acceptable and trustworthy before admitting
his/her membership.

[0025]Members in an existing client group, or a client who wants to join
the group as a new member, might be prone to fraudulent or otherwise
improper behaviour in some respect, at least in view of the other party.
It may be of interest for both the new member and the existing group to
make sure that him/her joining will not jeopardize security and comfort
by fraud or general "bad" behaviour, either intentionally or
unintentionally.

[0026]The aggregate behaviour within the group may thus be considered to
be a norm that its members are expected or required to follow. If one
member should deviate from the norm, the likelihood of fraud will
increase. For example, if a member conforming to the norm for a long time
suddenly starts to exhibit a divergent behaviour, his/her mobile terminal
may have been stolen or cloned. Currently, there are no useful and
reliable mechanisms for dealing with the issues above.

[0027]It is thus desirable to provide a solution that enables safe and
secure membership of a communication client in a group, and/or to reduce
or minimise the risk of fraudulent or otherwise improper behaviour in
some respect of a client or a group of clients.

SUMMARY

[0028]The object of the present invention is to address the problems
outlined above. This object and others are achieved primarily by
providing a method and apparatus for monitoring the behaviour of an
individual communication client in relation to the behaviour of a group
of communication clients, wherein the individual client has joined or
intends to join said client group for sharing client data.

[0029]In the inventive method, client data is collected based on
activities reflecting the individual client's behaviour in a
communication network, said collected client data forming a resulting
client behaviour profile. The collected client data is then compared with
a behaviour profile of the client group reflecting the behaviour of the
client group in a communication network. An alerting signal is issued if
an unacceptable behavioural deviation between the individual client and
the client group is detected.

[0030]The group behaviour profile may define an expected or required norm
of behaviour for the client group, and the alerting signal is then issued
if an unacceptable behaviour of the individual client in view of the
client group is detected. The group behaviour profile may also be
compared with the resulting client behaviour profile, and the alerting
signal is then issued if an unacceptable behaviour of the client group in
view of the individual client is detected.

[0031]The alerting signal may be provided as a notification to said
individual client or to an associated administrator, or as a notification
to at least one client in the client group or to an associated
administrator.

[0032]The group behaviour profile may be adjusted based on one or more
detected deviations between the individual client and the client group.
The client data can be collected by using any mechanisms for providing
call data records, presence data and context data. The collected client
data may relate to any of: browsing and downloading activities, financial
transactions, geographical movements, the duration of calls and sessions,
bandwidth consumption, and the time of day, week or season for different
client activities.

[0033]The group behaviour profile may be created based on a history of
client data collected for activities reflecting the client group's
behaviour, and may also be updated continuously based on client data
collected based on further activities by clients in the client group.

[0034]The inventive method may be used for detecting fraudulent or
otherwise improper behaviour. The collected client data may form a
plurality of resulting client behaviour profiles corresponding to a
plurality of client groups that the individual client has joined or
intends to join for sharing client data.

[0035]The inventive apparatus comprises a client database for collecting
client data based on activities reflecting the individual client's
behaviour in a communication network, a comparing unit for comparing the
collected client data with a behaviour profile of the client group, and
an alert generator for issuing an alerting signal if an unacceptable
behavioural deviation between the individual client and the client group
is detected.

[0036]The comparing unit may be adapted to compare the group behaviour
profile with said resulting client behaviour profile, and the alert
generator is adapted to issue the alerting signal if an unacceptable
behaviour of the client group in view of the individual client is
detected.

[0037]The alert generator may be adapted to provide the alerting signal as
a notification to said individual client or to an associated
administrator, or to provide the alerting signal as a notification to at
least one client in the client group or to an associated administrator.

[0038]The client database may be adapted to collect the client data by
using any mechanisms for providing call data records, presence data and
context data.

[0039]The inventive apparatus may be used for detecting fraudulent or
otherwise improper behaviour.

[0040]Further preferred features and benefits of the present invention
will become apparent from the detailed description below.

BRIEF DESCRIPTION OF THE DRAWINGS

[0041]The present invention will now be described in more detail by means
of preferred embodiments and with reference to the accompanying drawings,
in which:

[0042]FIG. 1 is a block diagram illustrating mechanisms for providing
presence data and context data for a communication client, according to
the prior art.

[0043]FIG. 2 is a block diagram of a behaviour monitoring server,
according to one embodiment.

[0044]FIG. 3 is a diagram illustrating the number of registered events
related to a certain measured parameter, when monitoring the behaviour of
an individual client and/or a client group.

[0045]FIG. 4 is a block diagram of a behaviour monitoring server in
communication with plural client data servers, according to another
embodiment.

[0046]FIG. 5 is a flow chart illustrating the basic steps for monitoring
the behaviour of an individual client in relation to a group of clients,
according to yet another embodiment.

[0047]FIG. 6 is a flow chart illustrating the basic steps for monitoring
the behaviour of an individual client in relation to a group of clients,
according to yet another embodiment.

DETAILED DESCRIPTION

[0048]Briefly described, the present invention provides an automatic
mechanism that can be used for checking, estimating or generally
monitoring the behaviour of a communication client in relation to the
behaviour of a group with plural clients, in order to detect any serious
or unacceptable deviations between them. It also enables relatively safe
and secure membership for an individual client in a group, from the
viewpoint of either the individual client or the existing client group,
or both. Further, the risk of fraudulent or otherwise improper behaviour
of a client or a group of clients can also be reduced, avoided or
minimised.

[0049]A behaviour profile may define an expected or required norm of
behaviour for clients in a group that an individual client has joined or
intends to join. The behaviour profile thus represents a behavioural
pattern or norm valid for clients in the group and may include only
certain behavioural parameters of interest to the group. The behaviour
profile or norm of the group can be created based on a history of client
data for members in the group collected over time for activities
reflecting the client group's behaviour.

[0050]In this solution, client data reflecting the individual client's
behaviour is collected on a continuous basis in a behaviour monitoring
server or the like, and the collected client data is compared with the
group behaviour profile in order to detect any behavioural deviations of
the individual client's client data from said profile, or vice versa. For
example, if it is detected that any collected client data indicates an
unacceptable or significant deviation of the individual client's
behaviour from the group behaviour profile, an alerting signal is issued,
e.g. as a notification to the individual client himself/herself, to the
client group or to an associated administrator or the like.

[0051]A client in an established group of clients thus displays a specific
behavioural pattern that can be detected by using the existing mechanisms
for providing call data records, presence services and client contexts,
although the present invention is not limited thereto. The client
behaviour discussed above may be reflected by various different
activities and parameters, such as browsing and downloading activities on
the Internet, financial transactions (amount, time, location, vendor,
etc), geographical movements, the duration of calls and sessions,
bandwidth consumption, and the time of day, week or season for different
activities, etc.

[0052]As mentioned above, the client data may thus be collected at a
server, e.g. by using any of the above-described mechanisms for providing
call data records, presence data and context data. This server will be
referred to as a "behaviour monitoring server" in the following to
indicate its activities. A procedure and arrangement for monitoring or
estimating the behaviour of an individual communication client in
relation to a group of communication clients according to one embodiment,
will now be described initially with reference to FIG. 2.

[0053]An individual client generally denoted 200 operates a mobile
terminal T connected to a mobile network N. In addition, one or more
sensors S may be arranged to detect various behaviour-related activities
and parameters of the client, providing raw client data to a context
server, not shown, in the manner described above. FIG. 2 thus generally
illustrates that terminal T, network N and/or sensor(s) S provide various
client data to a behaviour monitoring server 202, which is collected in a
client database 202a. The collected client data is thus generally based
on the individual client's activities in the network N, although it can
be detected, verified and provided by any of the illustrated terminal T,
network N or sensor(s) S, e.g. over a presence server or a context server
or any other suitable network node that can provide client data related
to the individual client's activities.

[0054]The collected client data defines a resulting behaviour profile CP
for the client 200 that reflects the actual behaviour of client 200 with
respect to the behavioural parameters and activities being monitored. A
comparing unit 202b is adapted to compare the collected client data with
a behaviour profile GP reflecting the behaviour of a group of
communication clients. The group profile GP may define a norm of expected
or required behaviour for the client group, as described above. The group
behaviour profile GP can be stored in the behaviour monitoring server
202, as shown in this example, or may be otherwise accessible to the
behaviour monitoring server 202, e.g., from a corresponding group data
server 204 serving the group. The group data server 204 may thus create
the group behaviour profile GP based on activities of the members of the
group 206, as indicated in the figure, and either send the profile GP to
server 202 or maintain it accessible to server 202.

[0055]If the comparing unit 202b detects that the collected client data,
e.g. according to the resulting behaviour profile CP, indicates a
behavioural deviation between the individual client and the client group
behaviour profile GP, an alerting signal A is issued from an alert
generator 202c. The alerting signal may thus work as a notification for
either an unacceptable behaviour of the individual client 200 in view of
the client group, or an unacceptable behaviour of the client group in
view of the individual client 200. In the shown example, the alerting
signal A is provided as a notification to the individual client 200 or to
an associated administrator (not shown). Alternatively, the alerting
signal may be provided as a notification to at least one client in the
client group or an associated administrator, or to any other interested
party.

[0056]It should be noted that FIG. 2 is a logic illustration of the
present embodiment. In practice, the solution according to this
embodiment can be modified in different ways, without parting from the
shown logic of the behaviour monitoring server 202. For example, the
described comparing function of unit 202b may be implemented in the group
data server 204 that generates and maintains the group profile GP. In
that case, the behaviour monitoring server 202 can send the resulting
client profile CP thereto, whenever a comparison and a behaviour
evaluation are desired or required. Likewise, the shown alert generator
202c may be implemented in the group data server 204 as well.

[0057]Alternatively, the comparing function of unit 202b and the alert
generator 202c may be implemented in a "third party" server that receives
the client profile CP and the group profile GP from client database 202a
and group data server 204, respectively.

[0058]FIG. 3 is a plotted diagram illustrating the number of registered
events related to a certain measured parameter reflecting a certain
behaviour of an individual client and a group of clients, respectively,
when monitoring the behaviour of the individual client in relation to the
client group. For example, an event may be registered when a call or
session is executed, and the measured parameter may then be the duration
of the call or session or the bandwidth consumed during the call or
session. In another example, an event may be registered when a
transaction of money is executed in a purchase, and the measured
parameter may be the amount transferred. In yet another example, sensors
may have registered that the transaction was invoked from a location
remote from an area between two further detected locations, which would
indicate that the personal data may have been illegitimately used in the
transaction by a malicious party not located where expected. It should be
noted that the examples above are particularly relevant for a mobile
client.

[0059]The full curve in FIG. 3 represents measurements for the behaviour
of an individual client, whereas the dashed curve represents measurements
for the aggregated behaviour of members in the client group. These curves
are built up over time as more and more events are registered. The
situation shown thus represents a certain point in time. Similar curves
can basically be considered for any measured behavioural parameter in
order to determine whether the behaviour of an individual client or a
client group can be deemed acceptable to the other party.

[0060]An accepted parameter range can be defined for the individual client
or for the client group in view of the other party, and in this example a
first range 1 of acceptable parameter values is indicated for the user
and a second accepted range 2 is indicated for the client group. An
accepted parameter range is thus defined by at least one threshold
determining when an alert signal is to be issued.

[0061]If an event is registered for the individual client falling outside
the accepted range 2, an alert generator can be arranged to issue an
alert signal to the group as a notification for an unacceptable behaviour
of the individual client in view of the client group. An alert signal may
also be issued to the individual client to notify him/her of the
unacceptable behaviour.

[0062]In the same manner, if an event is registered for someone in the
client group falling outside the acceptable range 1, the monitoring logic
can be arranged to issue an alert signal to the individual client as a
notification for an unacceptable behaviour of the client group in view of
the individual client.

[0063]Referring to FIG. 3, it is also possible to consider only one of the
two curves, or to define an accepted range 1 or 2 with only an upper (or
lower) limit or threshold of acceptance, such that an alert signal is
issued only for events when the upper (or lower) threshold is exceeded
(or not reached). Furthermore, warning thresholds can also be defined
such that the monitoring logic is adapted to issue a specific warning
alert signal when the warning threshold is exceeded (or not reached) but
not exceeding (or reaching) the threshold of acceptance.

[0064]FIG. 4 illustrates an arrangement for monitoring the behaviour of an
individual client 400, according to another embodiment. A behaviour
monitoring server 402 receives various client data related to the
behaviour of client 400 generally based on activities in a network using
a communication terminal (not shown), thus basically as described above
for FIG. 2, which is collected in a client database 402a.

[0065]In this embodiment, the client 400 has joined or intends to join
three client groups 1-3 being served by associated client data servers
404, 406 and 408, respectively. Thus, different group profiles GP.sub.1,
GP.sub.2 and GP.sub.3 are defined in the client data servers for client
groups 1-3, respectively. A client database is also illustrated in each
server 404-408 collecting client data X.sub.1, X.sub.2 and X.sub.3 for
the respective group members, basically in the same manner as client
database 402a.

[0066]A profile creating unit 402b in the behaviour monitoring server 402
is arranged to create separate resulting client profiles CP.sub.1,
CP.sub.2 and CP.sub.3 based on the collected client data, and which are
relevant for the client groups 1-3, respectively. Hence, client profile
CP.sub.1 is created with respect to certain aspects and behavioural
parameters of interest to the first group, and so forth, such that client
profiles CP.sub.1, CP.sub.2 and CP.sub.3 contain different sets of
behavioural parameters.

[0067]Collected client data according to behavioural parameters in each
resulting client profile CP.sub.1, CP.sub.2 and CP.sub.3 is then compared
with the group profiles GP.sub.1, GP.sub.2 and GP.sub.3 in order to
detect any behavioural deviations of the collected client data from said
group profiles, or vice versa. Just as in the example of FIG. 2, a
comparing unit or similar monitoring logic (not shown here) may be
arranged in the behaviour monitoring server 402 for performing the above
comparisons. An alert generator, not shown, is also arranged to issue an
alert signal if an unacceptable behavioural deviation is detected between
the individual client and any of the client groups, basically in the
manner described for FIG. 2. The alert signal may be provided as a
notification to any of the individual client and the client groups,
and/or to an interested third party.

[0068]Similar to the alternatives described for FIG. 2, the solution
according to this embodiment can also be modified in different ways,
without parting from the described logic of the behaviour monitoring
server 402. For example, a comparing function may be implemented in each
group data server 404-408 to which the respective resulting client
profiles CP.sub.1, CP.sub.2 and CP.sub.3 are sent.

[0069]FIG. 5 is a flow chart illustrating the basic steps for monitoring
the behaviour of an individual client in relation to a group of clients,
according to yet another embodiment. The shown steps may be executed by a
behaviour monitoring server, e.g., as described for any of FIGS. 2 and 4.
It is assumed that the individual client operates a communication
terminal when connected to a communication network.

[0070]In a first step 500, client data reflecting the individual client's
behaviour is collected using the terminal, the network and/or any
additional sensors, e.g. in the manner described above. At least client
data according to behavioural parameters of interest to the group should
be collected in this step.

[0071]In a next step 502, the collected client data is compared with a
group profile representing the behaviour of members in the client group,
in order to detect any behavioural deviations of the collected client
data from the group profile, or vice versa. The group profile may be
valid as a norm for expected or required behaviour within the group, thus
containing certain behavioural parameters of interest to the group.
Moreover, the group profile may also an aggregated result from client
data being collected for members in the group, e.g., using a client data
server serving the group.

[0072]It is then determined whether an unacceptable behavioural deviation
is detected between the individual client and the client group, in a
following step 504. If so, an alert signal is issued in a next step 506,
which may be provided to the client group and/or to the individual client
or a third party as a notification for the unacceptable behaviour, of
either the individual client in view of the client group or vice versa.
However, if no unacceptable behavioural deviation is detected in step
504, the process may return to step 500, and so forth. The process of
FIG. 5 may be repeated each time an event is registered for the
individual client or for a member in the client group.

[0073]FIG. 6 is another somewhat modified flow chart illustrating the
basic steps for monitoring the behaviour of an individual client in
relation to a client group, according to yet another embodiment. The
shown steps may be executed by a behaviour monitoring server, e.g., as
described for FIGS. 2 and 4, in order to detect any unacceptable
behavioural deviations of the individual client in view of the client
group, and vice versa. Just as in FIG. 5, client data reflecting the
individual client's behaviour is collected in a first step 600, and the
collected client data is compared with a group profile in a following
step 602, in order to detect any behavioural deviations between the
collected client data and the group according to the group profile.

[0074]It is then determined whether a behavioural deviation is detected
between the individual client and the client group, in a further step
604. If not, steps 600-604 are basically repeated until a behavioural
deviation is detected. If that occurs, it is further determined whether
the detected deviation indicates that the individual client's behaviour
is deemed unacceptable in view of the client group, in a step 606. If
not, it is further determined whether the detected deviation indicates
that the client group's behaviour is deemed unacceptable in view of the
individual client, in a further step 608. If it is determined that
neither the client group's behaviour is deemed unacceptable in view of
the individual client in step 608, the process returns to the initial
step 600.

[0075]If it is determined in step 606 that the individual client's
behaviour is deemed unacceptable in view of the client group, an alert
signal is issued in a step 610. Likewise, if it is determined in step 608
that the client group's behaviour is deemed unacceptable in view of the
individual client, the alert signal is issued in step 610. It is also
possible to modify the procedure by estimating the behaviour of both the
client and the group in steps 606 and 608 regardless of the outcome of
step 606, as indicated by the dashed arrow. The process of FIG. 6 may be
repeated each time an event is registered for the individual client or
for a member in the client group.

[0076]As mentioned above, an alert signal may be provided to any third
party being interested in detecting deviations between the behaviour of
the individual client and the behaviour of the client group. The third
party may be a merchant or vendor or the like serving the individual
client of interest. For example, the merchant may want to take some
suitable action if an unacceptable behaviour is detected, such as
blocking the client's credit card.

[0077]The third party may connect to the behaviour monitoring server (e.g.
202 or 402) or to a group data server, by sending an SIP SUBSCRIBE
message optionally containing selected limit or threshold values
determining when an alert signal is to be issued. The behaviour
monitoring server may then respond to the third party by providing the
alert signal carried by an SIP NOTIFY message. The third party may
communicate with the behaviour monitoring server over a PGM (Presence and
Group Management) server which is defined by OMA (Open Mobile Alliance).

[0078]In the solution described above by means of various embodiments, it
may of course be up to the individual client to decide which behavioural
parameter(s) to measure and use as a basis for the behaviour estimation,
i.e. the client data collected in the described client database 202a or
402a of FIGS. 2 and 4, respectively. In this way, the client's privacy
and integrity can be preserved.

[0079]By way of example, the present invention may be used for monitoring
the behaviour of the members in a group sharing an IPTV service, e.g. a
family. A group behaviour profile could then be created based on the
normal TV watching habits of the different members of the group. If the
children normally watch a children show between 6 pm and 7 pm, and the
parents normally watch the nine o'clock news at 9 pm, the resulting group
behaviour profile would include a viewing pattern of: 1) children's
programs between 6 pm and 7 pm, and 2) news between 9 pm and 10 pm. This
pattern may be verified and reinforced as the family continue to
basically follow the pattern. Small deviations from this pattern may be
accepted without alerts, as defined by the group. However, if a
significant divergence from the pattern is detected by registering events
for the viewing of adult movies around 1 am-3 am, the system may be
configured to issue an alert in the manner described above.

[0080]The above-described solution generally provides a simple yet
effective mechanism for early detection of fraud or otherwise improper
behaviour of a client or a group of clients. The inventive solution can
also be used to trigger a warning when irrational actions are made
unintentionally, such as if the individual client, e.g., by mistake makes
purchases over the used network by unintentionally pressing a button on
the terminal, or similar. The client can also discover behavioural
patterns about himself/herself, which provides added value and increased
control of usage history information.

[0081]While the invention has been described with reference to specific
exemplary embodiments, the description is generally only intended to
illustrate the inventive concept and should not be taken as limiting the
scope of the invention. For example, the SIP signalling protocol and IMS
concept have been used when describing the embodiments above, although
any other standards and service network types may basically be used. The
present invention is defined by the appended claims.